Authentication as a service account from the Android app for Google Cloud Storage

Question

I have an Android app that will ultimately store user content in a slave of Google Cloud Storage. But I can not do this from my application code. The code is as follows:

JsonFactory JSON_FACTORY = JacksonFactory.getDefaultInstance(); HttpTransport httpTransport = GoogleNetHttpTransport.newTrustedTransport(); KeyStore keystore = SecurityUtils.getPkcs12KeyStore(); keystore.load(resources.openRawResource(R.raw.secret), "***password***".toCharArray()); PrivateKey key = (PrivateKey)keystore.getKey("privatekey", "***password***".toCharArray()); credential = new GoogleCredential.Builder() .setTransport(httpTransport) .setJsonFactory(new JacksonFactory()) .setServiceAccountPrivateKey(key) .setServiceAccountId("**************@developer.gserviceaccount.com") .setServiceAccountScopes(Collections.singleton(StorageScopes.DEVSTORAGE_READ_WRITE)) .build(); credential.refreshToken(); String URI = "https://storage.googleapis.com/"+BUCKET_NAME; HttpRequestFactory requestFactory = httpTransport.createRequestFactory(credential); GenericUrl url = new GenericUrl(URI); HttpRequest request = requestFactory.buildGetRequest(url); HttpResponse response = request.execute(); String content = response.parseAsString(); Log.d("testing", "response content is: " + content); new Storage.Builder(httpTransport, JSON_FACTORY, credential).setApplicationName("Doubts").build(); 

I get various errors. One of them:

 java.security.KeyStoreException: java.security.NoSuchAlgorithmException: KeyStore JKS implementation not found 

The official documentation just ignores the use case for the Android app.

Answer 1

I would suggest taking responsibility for resolving the request from your Android client, as it is not considered a “trusted” client.

It is good practice to create a signed side of the URL and send it to the client so that the latter can use it to upload files to your buckets in a safe and opaque way. In this way, you will also remove the complexity and exposure to natural private credentials from your customers.

Read more about signed URLs in white papers